How to build and run OCI containers

Transcription

1 How to build and run OCI containers A shallow dive on the OCI container configuration and an overview of the available tools

2 whoami Spyros Trigazis Computing Engineer at CERN s cloud team Project Team Lead of OpenStack/Magnum

3 OCI containers A linux container is just process controlled by linux kernel cgroups and namespaces. OCI containers: defined by the OCI specification Runtime-spec: defines the config.json file from which a runtime know to run a container Image-spec: defines an OCI Image, consisting of a manifest, an image index (optional), a set of filesystem layers, and a configuration Filesystem-bundle: consists of the config.json file and the container root filesystem

4 Why we need them? Containers need a supervisor, eg Docker daemon, kubelet, systemd etc Systemd -> dockerd -> container, doesn t play very well Kubernetes implemented its own cri specification cri-contianerd: cri implementation based on containerd cri-o: cri implementation based on on runc What if you need a service running that docker depends on it?

5 CERN container service Fosdem Brussels Spyros

6 CERN Container Use Cases Batch Processing End user analysis / Jupyter Notebooks Machine Learning / TensorFlow / Keras Infrastructure Management Data Movement, Web servers, PaaS Continuous Integration / Deployment Run OpenStack :-) And many others

7 CERN Magnum Deployment Clusters are described by cluster templates Shared/public templates for most common setups, customizable by users $ openstack coe cluster create --name myswarmcluster --cluster-template swarm --node-count 100 ~ 5 mins later $ openstack coe cluster list uuid name node_count master_count keypair status myswarmcluster mysshkey CREATE_COMPLETE $ $(openstack coe cluster config myswarmcluster --dir magnum/myswarmcluster) $ docker info / ps /... $ docker service create --mount 'type=volume,volume-driver=cvmfs,source=cms.cern.ch@trunk-previous,destination=/cvmfs/cms.cer n.ch' busybox sleep 10000

8 Cluster node layout (swarm or kubernetes) Docker daemon Swarm agent CERN plugins OpenStack agent kubelet kube-proxy cri runtime OpenStack agent etcd CERN plugins flanneld

9 Building OCI containers

10 Building a system container Create: a dockerfile a systemd template a list of tmpfiles (if needed) a manifest.json for default values(if needed) the config.json Fosdem Brussels Spyros 10

11 Building a system container $ git clone $ sudo docker build -t strigazi/hello-system-container:latest.... $ sudo docker push strigazi/hello-system-container:latest $ sudo atomic install --system --name hello-world \ > strigazi/hello-system-container:latest... Copying config sha256:24908c0e3d9d78d c549b918df24af3ee9bc91c5e8866e4af90f4ca4f 3.29 KB / 3.29 KB [========================================================] 0s Writing manifest to image destination Storing signatures Extracting to /var/lib/containers/atomic/hello-world.0 systemctl daemon-reload systemctl enable hello-world $ sudo systemctl start hello-world Fosdem Brussels Spyros 11

12 Populating config.json Namespaces "namespaces": [ { "type": "mount" }, { "type": "ipc" }, { "type": "uts" } ], mount, cgroup, ipc, network, pid, user, uts

13 Populating config.json capabilities "capabilities": { "bounding": [ "CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_DAC_READ_SEARCH", "CAP_FOWNER", "CAP_FSETID", ] # #get the docker container pid # grep ^Cap /proc/4037/status # grep ^Cap /proc/4037/status awk '{print $2}' xargs -I val capsh --decode=val

14 Populating config.json mounts "mounts": [ { "type": "bind", "source": "/srv/magnum", "destination": "/srv/magnum", "options": [ "rbind", "rw", "rprivate" ] },...

15 Links Ping strigazi on Freenode #openstack-containers #atomic #centos-devel #fedora-devel Fosdem Brussels Spyros 15